CVE-2025-22422: Android Frameworks Base and Settings - Authentication Prompt Logic Flaw
Summary
CVE-2025-22422: In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-04-01
>= 14:0, < 14:2025-04-01
>= 15:0, < 15:2025-04-01
>= 15-next:0, < 15-next:2025-04-01
Fixed in 15-next:2025-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities for app development and system operations. It includes libraries and APIs that facilitate user interactions, security features, and system-level operations. The Settings application is integral to user configuration and management of device settings, including security and biometric authentication. This vulnerability affects both packages, potentially compromising user security through improper handling of authentication prompts.
Vulnerability Detail
In multiple locations within the Android Frameworks Base and Settings packages, a logic error allows for the possibility of misleading a user into approving an authentication prompt for one application, while the result is utilized by another application. This flaw can lead to local escalation of privilege without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly concerning for user security.
How To Fix
Minimum fixed version
15-next:2025-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to stay updated with the latest security patches from their device manufacturers.
Conclusion
The CVE-2025-22422 vulnerability poses a significant risk to users of the Android Frameworks Base and Settings packages due to a logic flaw in authentication prompts. It is crucial for users and developers to update to the latest patched versions to safeguard against potential exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-22422 is a vulnerability in the Android Frameworks Base and Settings packages that allows for potential privilege escalation through misleading authentication prompts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If your device is affected, ensure that you update to the patched version of the Android Frameworks Base and Settings packages as soon as possible.
No, user interaction is not required for exploitation, making this vulnerability particularly dangerous.
The potential consequences include unauthorized access to sensitive information and the ability to escalate privileges within the affected applications.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
